Description

Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowing non-Superadmin administrators to upload and extract arbitrary zip archives over the live application source code. Attackers can upload a malicious archive containing modified application files such as routes/web.php with embedded system commands, which execute as the web server user with access to environment secrets and database credentials.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-07T22:17:22.003Z",
  "pubdate": "2026-09-07T22:17:22.003Z",
  "executiveSummary": "Lara Dashboard versions prior to 1.3.2 are susceptible to an Arbitrary File Upload vulnerability that leads to Remote Code Execution (RCE).\nThe vulnerability resides in the POST /admin/settings/core-upgrades/upload endpoint, which enforces insufficient authorization by requiring only the 'settings.edit' permission instead of Superadmin privileges.\nBy successfully authenticating with limited administrative rights, an attacker can bypass intended access controls to upload and extract malicious zip archives directly into the application's root directory.\nThe primary risk is the ability for an attacker to overwrite critical system files, such as 'routes/web.php', with malicious code.\nUpon successful exploitation, the payload executes with the privileges of the web server user, granting the attacker access to sensitive environment configuration, database credentials, and full application control.\nThis vulnerability poses a critical risk to the confidentiality, integrity, and availability of the affected system, as it allows for persistent unauthorized code execution.",
  "technicalDetails": "The vulnerability is rooted in an inadequate Access Control List (ACL) implementation within the Lara Dashboard upgrade functionality. The endpoint 'POST /admin/settings/core-upgrades/upload' is improperly protected by the 'settings.edit' permission level, allowing users assigned this lower-tier administrative role to interact with a high-privilege system utility.\nThe exploitation process begins when an authenticated user with 'settings.edit' access navigates to the core upgrades interface. Because the endpoint lacks validation for Superadmin status, it accepts a user-supplied zip archive containing arbitrary files. The application's underlying logic subsequently proceeds to extract these files directly into the live application source code directory.\nAn attacker can leverage this mechanism to perform a path-traversal-style overwrite of existing application files. Specifically, by crafting a malicious zip archive that mirrors the directory structure of the application, an attacker can overwrite sensitive files such as 'routes/web.php'. By injecting system-level PHP execution commands or backdoors into these files, the attacker ensures that the payload is loaded and interpreted by the web server.\nOnce the malicious file is extracted, the web server executes the injected code whenever the corresponding route or file is accessed. Because the application server typically runs with the service account's permissions, the attacker gains the ability to interact with the underlying operating system. This grants the attacker visibility into the '.env' file, which typically contains plaintext database credentials, encryption keys, and third-party API tokens.\nPost-exploitation, the attacker can establish persistent access to the server, pivot into the internal network, or exfiltrate sensitive database content. The lack of integrity verification on the uploaded archive ensures that any file within the web-accessible directory can be modified or replaced, bypassing any application-level security controls enforced by Lara Dashboard itself. The exposure is global for any instance where the 'settings.edit' permission is delegated to untrusted or compromised administrative accounts."
}